Facebook fuels broad privacy debate by tracking non-users

Privacy concerns have swamped FB since it acknowledged that information about users wrongly ended up in the hands of political consultancy.

Concern about Facebook Incâ€™s respect for data privacy is widening to include the information it collects about non-users after Chief Executive Mark Zuckerberg said the worldâ€™s largest social network tracks people whether they have accounts or not.

Privacy concerns have swamped Facebook since it acknowledged last month that information about millions of users wrongly ended up in the hands of political consultancy Cambridge Analytica, a firm that has counted US President Donald Trumpâ€™s 2016 electoral campaign among its clients.

Zuckerberg said on Wednesday under questioning by US Representative Ben LujÃ¡n that, for security reasons, Facebook also collects â€œdata of people who have not signed up for Facebook.â€ Lawmakers and privacy advocates immediately protested the practice, with many saying Facebook needed to develop a way for non-users to find out what the company knows about them.

â€œWeâ€™ve got to fix that,â€ Representative LujÃ¡n, a Democrat, told Zuckerberg, calling for such disclosure, a move that would have unclear effects on the companyâ€™s ability to target ads. Zuckerberg did not respond. On Friday Facebook said it had no plans to build such a tool.

Critics said that Zuckerberg has not said enough about the extent and use of the data. â€œItâ€™s not clear what Facebook is doing with that information,â€ said Chris Calabrese, vice president for policy at the Center for Democracy & Technology, a Washington advocacy group.

Cookies everywhere

Facebook gets some data on non-users from people on its network, such as when a user uploads email addresses of friends. Other information comes from â€œcookies,â€ small files stored via a browser and used by Facebook and others to track people on the internet, sometimes to target them with ads.

â€œThis kind of data collection is fundamental to how the internet works,â€ Facebook said in a statement to Reuters.

Asked if people could opt out, Facebook added, â€œThere are basic things you can do to limit the use of this information for advertising, like using a browser or device settings to delete cookies. This would apply to other services beyond Facebook because, as mentioned, it is standard to how the internet works.â€

Facebook often installs cookies on non-usersâ€™ browsers if they visit sites with Facebook â€œlikeâ€ and â€œshareâ€ buttons, whether or not a person pushes a button. Facebook said it uses browsing data to create analytics reports, including about traffic to a site. The company said it does not use the data to target ads, except those inviting people to join Facebook.

Targeting Facebook

Advocates and lawmakers say they are singling out Facebook because of its size, rivalled outside China only by Alphabet Incâ€™s Google, and because they allege Zuckerberg was not forthcoming about the extent and reasons for the tracking.

â€œHeâ€™s either deliberately misunderstanding some of the questions, or heâ€™s not clear about whatâ€™s actually happening inside Facebookâ€™s operation,â€ said Daniel Kahn Gillmor, a senior staff technologist at the American Civil Liberties Union.

Zuckerberg, for instance, said the collection was done for security purposes, without explaining further or saying whether it was also used for measurement or analytics, Gillmor said, adding that Facebook had a business incentive to use the non-user data to target ads.

Facebook declined to comment on why Zuckerberg referred to security only. Gillmor said Facebook could build databases on non-users by combining web browsing history with uploaded contacts. Facebook said on Friday that it does not do so.

The ACLU is pushing US lawmakers to enact broad privacy legislation including a requirement for consent prior to data collection. The first regulatory challenge to Facebookâ€™s practices for non-users may come next month when a new European Union law, known as the General Data Protection Regulation (GDPR), takes effect and requires notice and consent prior to data collection.

At a minimum, â€œFacebook is going to have to think about ways to structure their technology to give that proper notice,â€ said Woodrow Hartzog, a Northeastern University professor of law and computer science. Facebook said in its statement on Friday, â€œOur products and services comply with applicable law and will comply with GDPR.â€

The social network would be wise to recognize at least a right to know, said Michael Froomkin, a University of Miami law professor. â€œIf Iâ€™m not a Facebook user, I ought to have a right to know what data Facebook has about me,â€ Froomkin said.